Logstash - 运行配置文件时注册插件时出错

Question

错误我得到：

[2018-03-05T09：22：00,976] [错误] [logstash.pipeline]注册插件时出错

[2018-03-05T09：22：01,023] [错误] [logstash.pipeline]管道由于错误而中止

[2018-03-05T09：22：01,070] [错误] [logstash.agent]无法执行操作{：id =>：main，：action_type => LogStash :: ConvergeResult :: FailedAction，：message =>“无法执行执行操作：LogStash :: PipelineAction :: Create / pipeline_id：main，action_result：false“，：backtrace => nil}

这是我的配置文件：

input {
    file {
        path => ["C:\logstash-6.2.2\conversation_stats\conversation_stats.json"]
        start_position => "beginning"
        sincedb_path => "/dev/null"
    ignore_older => 0
    }
}
filter{
    grok{
        match =>{ "message"=>"%{DATA:id} %{DATA:clientCode} %{DATA:conversationID} %{DATA:employeeID} %{DATA:entities.entity} %{DATA:entities.location} 
                %{DATA:entities.value} %{DATA:entities.confidence} %{DATA:input} %{DATA:intents} %{DATA:locale}"
        }
        overwrite => ["message"]
    }

}
output{
 stdout { codec => rubydebug }
 file { 
    codec => "json_lines"
    path => ["C:\logstash-6.2.2\Test\testOutput.json"]
 }

 elasticsearch{
        action =>"index"
        hosts => ["localhost:9200"]
        index =>"Converstation_Statistics_%{clientCode}"
 }
}

以下是一些示例数据：

{
    "_id" : ObjectId("5a2aa415"),
    "clientCode" : "demo",
    "conversationId" : "d6416ec0-da7aa79f3215",
    "employeeId" : "45",
    "entities" : [
        {
            "entity" : "status",
            "location" : [
                NumberInt("09"),
                NumberInt("210")
            ],
            "value" : "ok",
            "confidence" : NumberInt("11")
        }
    ],
    "input" : {
        "feedback" : {
            "feedbackSubject" : "my feedbac",
            "feedbackText" : "feedback\nthis is good\nI love this",
            "feedbackCategory" : "",
            "conversationId" : "d6416ec0-da7aa79f3215",
            "conversationText" : "(HI) [Greetings, human.]",
            "conversationNodeName" : "root"
        }
    },
    "intents" : [
        {
            "intent" : "feedbackresponse",
            "confidence" : NumberInt("1")
        }
    ],
    "locale" : "en-ca"
}

我有一个类似的json文件，它可以很好地上传到弹性而没有任何错误

在过去的几天里，我一直在寻找如何解决这个问题，并且没有提出任何建议，非常感谢帮助。

Answer 1

Elasticsearch通常托管在端口9200.因此，hosts => ["localhost:5601"]行可能应该更改为hosts => ["localhost:9200"]或托管ES实例的任何位置。